The information at hand does not conclusively determine if a crime has been committed or not. It is thus important to secure the scene of crime.
The plan for include developing the infrastructure to determine if an attack really happened and what are the extent. This will ascertain the validity of claims of breach and if confirmed take appropriate steps to retrieve reliable digital evidence that can be used sufficiently to sustain a case at the court of law. Before the start of digital investigation, time on all the servers was synchronized with NTP.
Verification of suspected crime will